Security and risk: how universities can protect their research and people

Threats from hostile state actors are the most prominent security issue universities face, but organisations face a range of other risks from state and non-state actors, who may:

• seek personal, financial or social gain through actively hostile and illegal actions, such as cyber-attacks, or through fraudulent or legally ambiguous business proposals and practices
• try to increase their scientific and technological advantage over other countries for economic and military gain
• seek to use these advantages against their own people
• use scientific and economic ties to the UK as a PR tool against accusations of human rights violations

UUK have released a number of security case studies. These anonymous case studies are real-life examples of security threats universities have faced, and how they responded to them, highlighting lessons learnt.

There are three major pieces of security guidance out there for the sector:

Managing risks in internationalisation: Security related issues

UUK’s guidance provides detailed guidance for universities on measures they should take to guard against hostile interference and promote academic freedom. It covers four broad areas:

1.  protecting your reputation and values
2.  protecting your people
3.  protecting your campuses
4.  protecting your partnerships

CPNI, Trusted Research Guidance for Academia

CPNI’s guidance outlines the potential risks to UK research and innovation. It’s designed to help researchers, UK universities and industry partners to have confidence in international collaboration and make informed decisions around those potential risks.

UKRI, Trusted Research and Innovation Principles

UKRI’s principles provide guidance on how to assess partner suitability, how to manage information and knowledge sharing, and legal and security implications of the commercial application of research collaboration and outputs.

Further resources

There is also an implementation guide summarising existing guidance, and suggesting first steps universities can take to make their operations secure. This is called Managing Risks in International Research and Innovation. 

We recommend that you first read the implementation guide, then the three individual pieces of guidance listed here, and then return to the implementation guide to plot your project to implement security-mindedness at your institution.

You can read more about this topic here. 

Amongst other actions, many universities have:

• unified due diligence management across departments, e.g. research, finance, and philanthropy
• reviewed risk registers and shared them across teams in a given institution
• reviewed due diligence processes and checks
• updated, revised, or created policies on institutional values, academic freedom and freedom of speech
• where necessary, reviewed or implemented policy and training programmes, staff training on security related matters, and created new working groups or reporting processes
• conducted cyber-attack and physical penetration tests to update virtual and physical security infrastructure
• ‘stress tested’ policies, such as using phishing email tests, visitor simulations, and crisis procedures against use cases

This is a non-exhaustive list of different actions universities have taken: to gain a full understanding of the security risks and processes to implement, please read in full the pieces of guidance referenced in the previous section.

You can find more examples of steps taken by universities from our security case studies. 

In addition to the guidance produced by sector and government bodies, there are a number of laws and regulations that universities must abide by in the security space. These include, but are not limited to:

1. National Security and Investment Act (NSI Act). The NSI Act requires investors to notify the government when acquiring legal entities operating in one of 17 sensitive areas of the economy - e.g. a university spinout company working in quantum technology or advanced materials.
2. Export control legislation, under which universities must apply for an export control license from the Department for International Trade when they are exporting technology, goods or software that are ‘controlled’. Controlled items and technologies include those which have military or dual military-civilian applications.
3. Academic Technology Approval Scheme (ATAS) which seeks to prevent the transfer of knowledge or technology which could support an Advanced Conventional Military Technology (ACMT) or Weapons of Mass Destruction (WMD) programme in countries that are non-exempt. International postgraduate students and researchers working in sensitive STEM areas are required to hold an ATAS certificate before applying for a visa.

Our managing risks in international research and innovation guidance suggests the following:

1. Appoint a member of your senior leadership team to take responsibility of security-related matters.
2. Review the three major pieces of guidance outlined in this briefing, and any other relevant guidance.
3. Assemble a team of stakeholders across your institution that have expertise in the recommended areas.
4. Review existing related processes and identify a list of recommended actions, with proposed leads and timescales, that you can turn into a project plan and present to your executive and/or board.
5. Set out an action plan with clearly defined senior responsibility owners and reporting to the governing body of your institution.
6. Ensure that security-related matters are on the radar of the governing board of your institution, and that developments are communicated appropriately. UUK guidelines recommend that the governing board of an institution receive an annual report on security risks.
7. Develop a plan to ensure that practitioners, academics, and broader academic services staff are aware of policy updates and their rationale and buy-in to the reasons for updates and changes. These plans should be regularly revisited and reviewed to reflect changing security priorities and threats.

1. Ensure that you have two-way conversations with academics and wider professional staff early on. It’s important that security matters are understood across the whole institution, and that they are seen as enabling rather than hindering.
2. Many universities have found that appointing internationalisation or security champions in different teams and faculties has worked well, as people tend to trust information coming from their peers. Departmental champions will understand day-to-day applicability and apprehensions better than professional services staff.
3. Ensure internal resources such as webpages are clear, up to date, and easy to access, ideally with named points of contact for further questions.
4.  Develop and clearly communicate points of contact on security issues to support internal discussions.
5. Have conversations across all teams and departments. Security-mindedness is not limited to research and partnership departments – it also relates to teaching, student services, students themselves, and other stakeholder groups who might not initially think that security issues concern them.
6. Tailor your message to your audience, making sure that it is practical, supported by supplementary material, and of appropriate complexity. Both messaging that is too complex and too simple can be unhelpful.
7. Develop clear messaging from senior leadership on how security issues are a priority.
8. Acknowledge that concerns are legitimate. Brushing concerns aside is counterproductive. Focusing on how security-mindedness enables excellent research and teaching, and that security measures exist to enable staff, is more productive than dismissing concerns.
9. Seek opportunities to engage in sector-wide conversations around security issues, to share reliable information and good practice.
10. Consider where training might be helpful.

Higher Education Export Control Association (HEECA)

HEECA is the sector-led national body of Higher Education Export Control practitioners in the UK. Their mission is to:

• Enable the sector to take an informed and consistent approach to Export Control Compliance.
• Provide a dynamic platform of expertise using our collective experience.
• Facilitate key discussions between practitioners, academics, regulators, funders and the government.
• Open HEECA membership to practitioners at all UK higher education research institutions.

You can contact HEECA on their website.

Research Collaboration Advice Team (RCAT)

RCAT supports academics and university leaders to understand risks and put in place appropriate and proportionate safeguards to support their collaborative activity. The RCAT does this by promoting greater understanding within the academic research community about the UK’s security policies and regulations, and by offering tailored risk-management guidance.

You can contact RCAT about research collaboration projects or other activity that you think you need external advice on. Your institution should have a nominated RCAT point of contact. If you are unsure who this is, please contact your Research Office.

NSI Act Investment Screening Unit (ISU)

If you have questions about whether an acquisition falls under mandatory notification under the NSI Act, you can contact BEIS Investment Screening Unit for an informal discussion about notifications or a future acquisition at: investment.screening@beis.gov.uk